Privacy Policy
How we keep your information safe.
NATIONAL CLINICAL PSYCHOLOGY SERVICE’S DATA PRIVACY & PROTECTION STATEMENT
Privacy Policy (Individuals and Organisations – Enquiries, Referrals and Website Use)
Effective date: 2 January 2026
Version: 1.1
Controller: Dr Jurai Darongkamas (marketing as National Clinical Psychology Service, “NCPS”)
Contact: ncps@clinicalpsychologyservice.co.uk | 0330 223 1844
Address: Dr Jurai Darongkamas (NCPS), c/o The Old Post Office, 1533 Pershore Road, Stirchley, Birmingham B30 2JH
ICO registration: ZC009363
1) What NCPS does (and does not do)
NCPS provides a referral and coordination service. We help connect enquirers with a potentially suitable independent HCPC-registered Clinical Psychologist by facilitating an introduction based on the information provided.
NCPS does not provide psychological assessment, diagnosis, therapy, treatment, or rehabilitation. Any triage calls or document review performed by Dr Jurai Darongkamas/NCPS are for referral potential suitability/coordination only and do not constitute clinical assessment or treatment. If you proceed, any psychological services are provided by the independent Clinical Psychologist under their own terms and privacy notice, as a separate data controller.
Controller signposting: NCPS is the controller for referral/coordination records. The independent Clinical Psychologist is the controller for clinical records and will provide their own privacy notice.
2) Who this Privacy Policy applies to
This Privacy Policy applies to:
- Individuals (adults, children, parents/carers) who contact NCPS or use NCPS to arrange a referral; and
- Organisations (e.g., solicitors, agencies, rehabilitation providers, employers, insurers, schools, local authorities) who instruct NCPS to facilitate a referral and/or provide coordination, administrative support, and (where agreed) invoicing/collection arrangements.
3) Personal data we collect
- Individuals (enquiries and referrals)
We may collect:
Identity and contact
- Name, title, contact details, date of birth (where relevant), address (where relevant).
- GP practice and emergency contact details where relevant and provided to us for coordination/safeguarding purposes.
- We will ask for your preferred contact method and any restrictions (e.g., no voicemail) and will apply these where reasonably possible.
Referral information (may include special category health data)
- A description of difficulties, aims for support, and information relevant to matching (including any existing/previous involvement with professionals and other health-related data).
- Risk/safety information where relevant to safe referral.
- Documents you choose to share (e.g., prior reports). If extensive review is required, any fee will be disclosed in advance.
Communications and administration
- Emails/calls/messages relating to your enquiry and referral coordination.
Financial (limited)
- NCPS does not charge individual self-referrers for referral services. If you separately agree to a paid administrative review, we process the minimum invoicing/payment information needed.
Website/technical
- Basic device and usage data (see section 13).
You are not under a statutory obligation to provide information. However, if you do not provide sufficient information for suitability and safe referral, we may be unable to progress your enquiry or make an introduction.
- Organisations (instructions and referrals)
We may process:
Organisation contact data
- Names, professional contact details, role, correspondence, and procurement/purchase order information.
Proposed Patient data (may include special category data)
- Identity/contact data needed for coordination (e.g., name and contact details; date of birth/address only where relevant).
- Referral/instruction context, presenting issues, relevant background, and risk/safety information where necessary for safe matching and coordination.
- Documents you provide (e.g., summaries, bundles, prior reports, Criminal offence data {where included in instruction materials}), limited to what is needed for referral suitability and coordination. We do not circulate full bundles widely; we limit access and share only what is necessary for suitability and coordination.
Financial/transaction data
- Where agreed, referral/admin fee invoicing.
- Where agreed, invoicing on behalf of an independent Clinical Psychologist and/or collection-agent arrangements, including receiving and transferring funds.
4) Where we get your data from
We may receive information:
- from you directly (webform, email, phone);
- from a parent/carer for a child, where appropriate;
- from someone making first contact on your behalf (e.g., extended family member or friend); and/or
- from a professional or organisation (e.g., solicitor, school, insurer) where you have asked them to refer or they have lawful authority to share information for referral purposes.
5) Why we use your data
We use personal data to:
- respond to enquiries and determine if we can assist;
- match an individual/Proposed Patient with a potentially appropriate independent Clinical Psychologist;
- coordinate initial arrangements (availability checks, introductions, first appointment logistics);
- to administer referral introduction outcomes (including where a commission/fee is payable by a clinician);
- where payment collection arrangements apply (for some referral via organisations), we may share limited invoicing/payment status with the instructed clinician and retain accounting records required for audit/tax;
- manage service quality, complaints, and governance;
- maintain safety and safeguarding where relevant; and
- meet legal and regulatory requirements (where applicable).
6) Lawful bases (UK GDPR)
Article 6 (general personal data)
We rely on one or more of:
- Contract – to provide the referral/coordination service requested or instructed and to manage related communications.
- Legitimate interests – to run and protect our referral service (e.g., record-keeping, quality assurance, complaint handling, service security and fraud prevention), balanced against your rights.
- Legal obligation – where we must comply with law (e.g., limited accounting obligations where applicable).
Article 9 (special category data, including health data)
Where referral/instruction information includes special category data (such as health data), we rely on one or more of:
- Health or social care management / health professional confidentiality where applicable for referral coordination conducted under the responsibility of a regulated health professional and subject to confidentiality.
- Legal claims where necessary to establish, exercise or defend legal claims (e.g., complaint or dispute; litigation-related instructions).
- Explicit consent where required for a specific disclosure or where the context indicates consent is the appropriate condition (for example, a disclosure outside standard referral coordination).
Referral coordination is usually processed under contract (or steps you ask us to take before a contract) and/or our legitimate interests. We use explicit consent only where required for a specific disclosure outside standard referral coordination.
Withdrawal of consent: Where we rely on explicit consent for a specific disclosure, you can withdraw it at any time. Withdrawal may prevent us from completing that disclosure and, in some circumstances, may prevent a referral from being completed.
In practice, for referral coordination involving health information, we rely on the health/social care condition where the processing is under the responsibility of a regulated health professional and subject to confidentiality; we use explicit consent for non-standard disclosures
Organisations – lawful authority warranty and transparency handoff
Where an organisation provides information about a Proposed Patient, the organisation confirms it has lawful authority to share personal and (where applicable) special category data with NCPS for referral and coordination purposes.
Transparency handoff (organisations): Where you are the controller providing information about a Proposed Patient, you are responsible for providing them with appropriate privacy information about this sharing, unless an exemption applies.
Where we receive Proposed Patient data indirectly, we will provide (or support the provision of) appropriate privacy information by letting the person/s know where exactly our privacy information is on our website, within a reasonable period and, in any event, within one month, unless an exemption applies.
Article 10 (criminal offence data): where processed, we rely on the relevant DPA 2018 Schedule 1 condition(s) and maintain required documentation, including an Appropriate Policy Document where applicable.
Where required under the DPA 2018, we maintain an Appropriate Policy Document describing our safeguards and retention/deletion approach for relevant special category and criminal offence data.
7) Who we share data with
We do not sell personal data. We share only what is necessary and proportionate, including with:
- Independent Clinical Psychologists involved in considering/accepting a referral (anonymised initially where possible; identifiable when appropriate for referral progression).
- NCPS administrators assisting with coordination/invoicing tasks (limited access).
- GPs or other professionals where requested and authorised.
- Safeguarding / emergency services where lawful and necessary (e.g., serious risk of harm).
- Professional advisers/insurers/legal advisers where needed for complaints, legal matters, or regulatory issues.
Service providers (processors): We use service providers supporting our IT, hosting, email, document management, and website security, under contractual obligations. These may include:
- website hosting provider;
- WordPress maintenance/IT support;
- Google Workspace (email and document systems); and
- security tools such as Google reCAPTCHA.
International transfers: Some service providers (for example, Google Workspace and Google reCAPTCHA) may process personal data outside the UK. Where this occurs, we rely on appropriate safeguards and contractual protections designed to help protect personal data. We also rely on Google’s terms/privacy information for reCAPTCHA and those can be reviewed.
Automated risk analysis (website security): reCAPTCHA uses automated risk analysis to help determine whether website traffic appears to be automated; this may affect whether a form submission is accepted.
We typically share limited, non-identifying referral information where practicable referral information first to check potential suitability/availability. If you agree to proceed, we then share identifiable details to enable the clinician to contact you and arrange the first appointment.
Independent Clinical Psychologists may pay NCPS a commission/fee when a referral is introduced and accepted. To administer this, we may record the referral outcome and limited administrative details. This does not affect the clinician’s professional independence or your freedom to choose whether to proceed.
8) Children and families
We take extra care with children’s information. At the start we will explain:
- who the service is for (child/parent/family);
- how confidentiality works in practice; and
- when information may need to be shared for safeguarding.
We can provide a child-friendly version of this Privacy Policy on request.
9) Security
We use appropriate organisational and technical measures (access controls, secure storage, secure transfer methods, and secure disposal of paper records).
- Your information will be kept on a password-protected computer with appropriate antivirus, malware and firewall protection.
- Any personal information you provide, kept on paper, is stored in locked metal cabinets within a secure office.
- Paper records will be destroyed using a cross cutting shredder at time of destruction.
- Email is not always fully secure; if you prefer, we can discuss alternative secure ways to share sensitive documents, including via an encrypted email system that we subscribe to and which you can use for no cost.
10) Retention
We keep personal data only as long as necessary.
NCPS referral/coordination records
- Enquiries that do not proceed: deleted after 6 months (or sooner on request, unless we need to retain limited information to evidence how we handled the enquiry or to comply with legal obligations).
- Referrals that proceed: we retain minimal referral coordination records for 7 years (adults) or until age 25 (children) for governance, safeguarding, and complaint/legal purposes.
- Minimal referral coordination records typically include: identity/contact details, referral summary information, referral outcome, key communications, and (where applicable) safeguarding/complaint correspondence.
- Exceptions: we may retain relevant data longer where required for safeguarding, complaints, or legal matters.
Clinical records
Clinical records for therapy/assessment are held by the independent Clinical Psychologist as a separate controller, under their retention policy.11) Your rights with regard to your data
You have rights including:
- Access
- Rectification (have inaccuracies corrected)
- Erasure (where applicable)
- Restriction
- Data portability (where applicable)
- Object
- Withdraw consent
- Rights related to automated decision-making
- Complain to the ICO
Note these rights are not absolute and can be overridden by other interests in extremely rare and special circumstances, e.g., court subpoenas.
The right to have information deleted is also not absolute and specific circumstances must apply.
If information we hold is subject to legal professional privilege, we may be unable to disclose it in response to an access request.
If a personal data breach is likely to result in a high risk to your rights and freedoms, we will notify you where required.
Please note:
- We do not normally charge for requests.
- We may ask for information to verify your identity before responding.
- We respond within statutory time limits (normally one month).
- If your request relates to an independent Clinical Psychologist’s clinical records, we will direct you to that independent Clinical Psychologist as the relevant controller.
- We do not make decisions that produce legal or similarly significant effects based solely on automated processing. Website security tools (e.g., reCAPTCHA) use automated risk analysis to protect against spam/abuse, which may affect whether a submission is accepted.
To exercise your rights, email ncps@clinicalpsychologyservice.co.uk with “Data protection request” in the subject line and tell us what you need.
12) Complaints
Contact us first: ncps@clinicalpsychologyservice.co.uk. You may also complain to the Information Commissioner’s Office (ICO).
The ICO’s (Information Commissioner’s Office) main contact details are their website ico.org.uk, phone number 0303 123 1113, and postal address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
13) Cookies, WordPress and Google reCAPTCHA
Our website is built on WordPress and uses cookies and similar technologies to ensure the site functions properly, to keep it secure, and to help us understand how the site is used.
Cookie banner / choices: A cookie notice is shown when you first visit our website. You can manage cookie settings through the banner (where available) and/or through your browser settings.
Essential and security cookies: Some cookies are necessary for the website to work and to protect it from malicious or automated activity.
Our hosting may log IP address, device/browser details, and pages accessed for security, troubleshooting, and service improvement.
Google reCAPTCHA (anti-spam): Our website forms may be protected by Google reCAPTCHA, which helps prevent spam and automated abuse. When reCAPTCHA runs, it may set a necessary cookie (commonly “_GRECAPTCHA”) and process technical information (such as IP address and device/browser information) for security and risk analysis purposes.
Lawful basis for website security tools: We use essential cookies and security tools such as reCAPTCHA on the basis of our legitimate interests in protecting our website and preventing fraud/abuse.
Links to other websites. This website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of such third-party websites or any association with their operators. We do not control these websites and are not responsible for their personal data practices. We urge you to review any privacy policy posted on any site you visit before using the site or providing any personal data about yourself.
14) Changes to this Privacy Policy
We may update this Privacy Policy from time to time. The latest version will be posted on our website and will show the effective date above.